--- a/mod_http_oauth2/mod_http_oauth2.lua	Sat May 06 17:06:13 2023 +0200
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Sun May 07 19:06:37 2023 +0200
@@ -137,8 +137,13 @@
 		granted_scopes = array();
 	end
 
+	if requested_roles then
+		granted_scopes:append(array.filter(requested_roles, function(role)
+			return can_assume_role(username, role)
+		end));
+	end
+
 	local selected_role = select_role(username, requested_roles);
-	granted_scopes:push(selected_role);
 
 	return granted_scopes:concat(" "), selected_role;
 end